ci: grant actions:read, count jobs safely, cover bundler

Three fixes from the second review on #844.

Add `actions: read`. Declaring a permissions block sets every unnamed scope to
none, and the coverage gate lists the triggering run's jobs, so the Actions API
would have returned 403 and aborted the step on every Dependabot pull request.
It fails closed, but the automation would never have merged anything.
commitlint-comment.yaml declares the same scope for the same reason.

Count job names instead of asking jq for a length. `--paginate` applies `-q` per
page, so a run spanning two pages yields one count per line ("18\n4"), and
`[[ "18\n4" -eq 0 ]]` is an arithmetic syntax error that evaluates false —
skipping the refusal and merging. Verified in bash: the multi-line form errors
with "syntax error in expression" and takes the else branch. Single-page today at
22 jobs, but the failure direction is fail-open, and the headroom is smaller than
it looks.

Add the bundler ecosystem for examples/sinatra/app/src/Gemfile, which the original
sweep missed. Beyond grouping, this is what gives those PRs a conventional commit
prefix: Commit Lint runs on every pull request with no path filter, and #799 shows
what the default message costs — commit "bump
com.fasterxml.jackson.core:jackson-databind", Lint Commit Messages red.

Author: bnusunny

.github/dependabot.yml

@@ -105,3 +105,22 @@ updates:
         applies-to: security-updates
         patterns:
           - "*"
+
+  # examples/sinatra/app/src/Gemfile. Easy to miss, and the cost of missing it is not
+  # just ungrouped PRs: without `prefix: chore` Dependabot writes "bump rack from ...",
+  # which has no conventional type, and Commit Lint runs on every pull request with no
+  # path filter. #799 is the evidence — its commit message is
+  # "bump com.fasterxml.jackson.core:jackson-databind" and its Commit Lint check is red.
+  - package-ecosystem: bundler
+    directories:
+      - "/examples/**"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    commit-message:
+      prefix: chore
+    groups:
+      examples-bundler:
+        applies-to: security-updates
+        patterns:
+          - "*"

.github/workflows/dependabot-automerge.yaml

@@ -20,6 +20,11 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  # Required to list the triggering run's jobs. Declaring a permissions block sets
+  # every scope not named here to none, so without this the Actions API returns 403
+  # and the step aborts on every Dependabot pull request. Same reason
+  # commitlint-comment.yaml declares it.
+  actions: read
 
 jobs:
   merge:
@@ -98,9 +103,15 @@ jobs:
             exit 0
           fi
 
-          # Covered examples are only actually verified if their jobs ran.
+          # Covered examples are only actually verified if their jobs ran. Count lines
+          # rather than asking jq for a length: --paginate applies -q per page, so a
+          # run spanning two pages would yield one count per line ("18\n4"), and
+          # `[[ "18\n4" -eq 0 ]]` is an arithmetic syntax error that evaluates false —
+          # skipping the refusal below and merging. Only the job total keeps this
+          # single-page today, which is not a property worth depending on.
           verified=$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs" --paginate \
-            -q '[.jobs[] | select(.name | startswith("test-")) | select(.conclusion == "success")] | length')
+            -q '.jobs[] | select(.name | startswith("test-")) | select(.conclusion == "success") | .name' \
+            | wc -l)
           if [[ "$verified" -eq 0 ]]; then
             echo "No test-* job succeeded in run $RUN_ID; refusing to merge."
             exit 0